CAINE Forensics series 08 Windows Registry analysis using Autopsy

♥ SUBSCRIBE for more videos: https://www.youtube.com/bluemonkey4n6...



Difficulty Level: Medium
Prerequisites:
basic understanding of the Windows Registry,
basic understanding of the Autopsy framework of forensic tools

In this video we will look at using Autopsy to answer some basic questions when performing a digital forensic analysis on a computer.

Video timeline
00:00 intro
00:48 Autopsy setup
03:13 Question 1: What operating system was used on the computer?
04:16 Question 2. When was the install date?
04:43 Question 3. Who is the registered owner?
04:58 Question 4. What is the computer name?
05:19 Question 5. Who was the last user to logon into PC?
06:01 Question 6. What is the account name of the user who mostly uses the computer?
06:24 Question 7. When was the last recorded computer shutdown date/time?
09:49 Question 8. What is the timezone settings?
10:28 Question 9. Explain the information of network interface(s) with an IP address assigned by DHCP.
11:39 Question 10. List all accounts in OS except the system accounts: Administrator, Guest, systemprofile, LocalService,
12:14 Question 11. What applications were installed by the suspect after installing OS?
13:01 Question 12. List external storage devices attached to PC.
13:47 recap




⭕ For other videos about the Linux command line, see other videos in this series:    • CAINE forensics tutorials  

Linux distro:
CAINE linux (https://www.cainelive.net). Using CAINE v12 beta

Virtualization software:
Virtual Box (http://virtualbox.org)

Digital Forensics platform:
Autopsy v4.17.0 (https://www.basistech.com)


Images used for examination:
Computer Forensic Reference Data Sets (CFReDS) from NIST (https://www.cfreds.nist.gov/data_leak...)


This course was designed to provide information on how to use the tools on the CAINE forensics distro to accomplish tasks in the basic steps in digital forensics: Preservation of evidence (write blocking), extraction of data (imaging), Analysis, and Reporting.  This course covers the tools that allow users to acquire data (logical and physical), forensically analyze data, hashing datasets, perform malware analysis, memory forensics, mobile forensics, network forensics, open source intelligence (OSINT), and timeline analysis. 

This video will look at using Autopsy’s built in Ingest modules to access and analyze the Windows Registry.


#DFIR #windowsregistry #autopsy